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Abstract 

In this paper we suggest a new data structure for 
location management in mobile networks. The data 
structure is based on the tree location database struc- 
ture. We suggest replacing the root and some of the 
higher levels of the tree with another structure that 
balances the average load of search requests. For 
this modification we use a stUary butterfly network, 
which is a generalization of the well-known k-ary but- 
terfly. We also suggest modifying the lowest level of 
the tree in order to reflect neighboring geographical 
regions more accurately and to support simple loca- 
tion data management. The modification of the low- 
est level also supports simple handoffe. The update of 
the proposed location database ensures correct loca- 
tion data following any number of transient faults that 
corrupt the location database information and thus is 
self-stabilizing, 

1 Introduction 

Mobile computers using wireless communication 
are becoming increasingly prevalent. This trend grows 
with the availability of powerful portable comput- 
ers and the construction of infrastructure for wire- 
less communication used by cellular phones. In the 
near future, new computer services will accompany us 
wherever we are: mail, local news, local information, 
etc. (See, e.g., [5, 6]). Location management is an 
important task for mobile systems. Whenever a con- 
nection is to be established with a mobile computer, 
knowledge of the location of this mobile computer is 
required. Mobile systems have to cope with frequent 
location updates and inquiries. Thus the distributed 
database used for location management, as well as the 

*Thia research was supported by TAMU Engineering Ex- 
cellence funds, by NSF Presidential Young Investigator Award 
CCR- 9396098. E-mail: anion!, pradhan 1 9 tlchCcs.tama.odu. 



update and search (inquiry) procedures, have great 
influence on the performance of the system. The loca- 
tion database is maintained by location servers which 
are located in a physical wired network of fixed loca- 
tion hosts. Any fixed host may act as a location server, 
i.e., have a process dedicated to maintaining the loca- 
tion database and answering inquiries concerning the 
location of a mobile host. The task of the location 
servers is to update the location database whenever 
a mobile host decides to relocate, and to answer lo- 
cation inquiries. Next we describe several approaches 
for location management. 

One solution is a centralized location database that 
is maintained at a single site by a single location 
server. This solution implies a severe bottleneck in 
the performance, since every update or search is ex- 
ecuted by the single location server. Moreover, the 
cost (i.e. number of operations in the database) of an 
update for a relocation is fixed and does not depend 
on the distance between the previous and current lo- 
cations. For example, a movement within a city and 
a movement to a new continent are treated the same, 
yet many movement are likely to take place within a 
city, while movements to another continent are rare. 

A distributed and hierarchical approach for loca- 
tion management is a tree structure of location servers 
(e.g., [5, 6]). The tree structure is embedded in the 
fixed network. The leaves of the tree are mobile sup- 
port stations. Each mobile support station is responsi- 
ble for the communication with mobile hosts within a 
small geographic region called a cell Each mobile sup- 
port station maintains a list of the mobile hosts within 
its cell. Several mobile support stations are connected 
to a single location server, which is their parent in the 
tree structure. Every non-leaf location server, s< , has 
a list, listj , of the mobile hosts for every j'th child of 
$i. listj contains the identifiers of the mobile hosts 
that are in the cells of the leaves of the subtree rooted 
at 8j . The tree structure of location servers is both 
distributed and hierarchical and hence fits better than 
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the centralized solution discussed above. 

Another location management scheme is based on 
home location servers (e.g., [5]). In this scheme, each 
mobile host is registered in a fixed home location 
server located in the fixed network. The current lo- 
cation of the mobile host is maintained at this home 
location server. Whenever a mobile host, m, moves 
from one cell to another (or after some constant num- 
ber of moves when forwarding pointers are used), the 
address in the fixed home location server has to be 
updated. This approach might be efficient when the 
mobile host is almost always close to its home loca- 
tion server. However, for the cases of high mobil- 
ity and when m is far from its home location server, 
many long distance updates have to take place. More- 
over, in some cases a search inquiry is for a mobile 
host with special attributes within a geographic re- 
gion, e.g., search for a medical doctor within a short 
distance. The tree structure naturally supports such 
inquiries. An inquiry message may be sent directly to 
the location server that is a root of a subtree includ- 
ing every mobile support station in some geographical 
region. In contrast, for the home location server it is 
hard to find a medical doctor that is present in the 
region but has a distant home location server. 

This paper investigates the properties of the tree 
structure and suggests a modified "tree" structure for 
location management. We define the level of a node 
s in a tree to be the number of tree links in the path 
from the root of the tree to s, e.g. the level of the 
root is 0. The first observation made is related to 
the upper levels of the tree structure — where upper 
(lower) levels are the levels close to (far from, respec- 
tively) the root. An initiator of a location inquiry for 
a highly mobile host is uncertain about the location of 
the mobile host. The tree structure is hierarchical: a 
node in level i has information regarding more mobile 
hosts than a node in level t + 1. Naturally, a location 
inquiry for highly mobile host is initiated by sending 
an inquiry message to the root of the location servers 
(or to a location server with relatively small level in 
the tree). This fact implies a heavy load on the root of 
the location server tree, which in turn implies a bottle- 
neck on the performance of the location servers. For 
example, a search for a mobile host within Manhattan 
may start with the root of the subtree of the location 
servers that maintain the location data of all the mo- 
bile hosts in Manhattan. Since the number of mobile 
hosts in such a dense area may be big, this location 
server will be overloaded with inquiries. We suggest 
a new tree structure for such cases that preserves the 
benefits of the tree and balances the inquiry load. In- 



terestingly, the solution is based on the well known 
k-ary butterfly network (cf. [7]). 

The second observation is related to the lower lev- 
els of the tree structure. The leaves of the tree cor- 
respond to geographic regions. Movements between 
neighboring geographic regions have high probability 
of happening. In order to minimize the location up- 
dates, one would like to guarantee that any two neigh- 
bors will have the same parent in the tree; however 
this would result in there being a single parent for all 
leaves in the tree, which is a non-hierarchical struc- 
ture. A tree structure with h > 1 levels may not be 
symmetric in the following sense: some neighbors have 
a common parent while others do not. In fact, there 
can be leaves corresponding to neighboring geographic 
regions whose only common ancestor is the root of the 
tree. Thus, the maximal delay for completing a loca- 
tion update depends on the number of levels in the 
tree. An inquiry initiated during such a slow location 
update might not result in the address of the mobile 
host. 

Some techniques of using forwarding pointers, in- 
stead of updating the location servers' data, have been 
proposed to cope with the delay in the updates (e.g., 
[4, 1]). The pointer chain is extended whenever the 
mobile host move9, until at some point an update of 
the hierarchical database is executed and the point- 
ers are eliminated. Pointers solve the problem of the 
long delay for updates but introduce new problems — 
longer search, pointer management including periodic 
updates in order to eliminate too long pointer chains. 
Moreover, it is hard to recover following corruption 
of a pointer (due to a transient fault, say crash and 
recovery of a location server). We propose to use the 
fact that mobile hosts move from neighbor to neighbor 
to ensure fast updates without the use of pointers. 

We suggest adding connections to the lowest level of 
the tree such that any two location servers that cor- 
respond to neighboring geographic regions will have 
either a common parent or a direct link connecting 
them. Note that when the regions are hexagons, at 
most six additional connections per leaf are required. 
We show that the modified lowest level of the tree 
solves the problem of unsuccessful inquiries due to up- 
date delay. Handoff takes place when a mobile sup- 
port station moves from one cell to another during 
a communication session. The information transmit- 
ted to the previous mobile support station is easily 
forwarded to the new mobile support station through 

their common link. Note that h an doffs and location 
management serve different purposes — handoff is not 
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required unless a communication session is in progress 
while a mobile host moves from one cell to another, 
whereas location management is always required. We 
show how handoff executions are improved with the 
lower level modification. The improvement is by the 
simplicity of executing local broadcast (of distance t) 
in the presence of the additional links. Local broad- 
cast of distance t is a broadcast initiated by a mobile 
support station that reaches every mobile host within 
cells of distance t from itself. 

A self-stabilizing system [2] can be started in an 
arbitrary initial state and regains its consistency by 
itself. A self-stabilizing system can recover from tran- 
sient faults, faults which change the state of one or 
more components of the system. The self-stabilization 
property is very important for on- going tasks such as 
topology update (See e.g., [3]). We view the location 
management task for mobile systems as a topology up- 
date under special settings — a subset of the system 
components (the mobile hosts) change their location 
frequently. Our goal is a self-stabilizing location man- 
agement scheme that copes with transient faults. In 
other words a self-stabilizing location database must 
guarantee that starting with any correct or incorrect 
location data for the mobile hosts (resulting from ar- 
bitrary transient faults, e.g., message loss, memory 
corruption) eventually each mobile host can be found 
using the location database. 

We present a location management scheme that 
does not use forwarding pointers. The self- 
stabilization property is achieved easily when these 
forwarding pointers are eliminated. Beyond the self- 
stabilizing property, the modifications of the upper 
and lower levels of the tree also result in a more ro- 
bust mobile system that can tolerate location server 
crashes. In the next section we describe in detail 
the distributed mobile environment. In Section 3 we 
present the modifications for the upper levels and low- 
est level of the tree. In Section 4 we present a self- 
stabilizing location management scheme. Concluding 
remarks are in Section 5. 

2 Distributed Mobile Environment 

A mobile network is composed of a fixed network 
and a wireless network that interact with each other. 
The fixed network is a standard point-to-point com- 
munication network in which the communication be- 
tween fixed location hosts is carried by physical wire 
links. Some of the fixed hosts are equipped with wire- 
less transceivers. These fixed hosts are called mobile 



support stations (or base stations). Each mobile sup- 
port station is capable of transmitting and receiving 
messages from a limited geographical region around 
it. This region is called the cell of the mobile support 
station. Thus, the geographic area in which the wire- 
less network service exists is partitioned into cells and 
a mobile support station is located in every such cell. 

The wireless network consists of mobile hosts which 
have the capability to exchange messages with a mo- 
bile support station. The mobile host can communi- 
cate with a mobile support station that is within a 
short distance from itself. The mobile host may move 
from one cell to another while communicating with the 
fixed network (or with another mobile host through 
the fixed network). At every instance the communica- 
tion is carried by the mobile support station of the cell 
in which the mobile host is currently located. Data on 
the location of mobile host is maintained in the fixed 
network by location servers. Any fixed host may act 
as a location server, i.e., have a process dedicated for 
maintaining the location database and answering in- 
quiries concerning the location of a mobile host. In 
particular, mobile support stations may also act as lo- 
cation servers. The precise characterization of the lo- 
cation database and the update and search procedures 
is up to the system designer. Our focus in this paper is 
an hierarchical location management strategy that is 
based on a tree structure of location servers which we 
now describe. (The idea of using a tree structure has 
been proposed in, e.g., [5, 6]; in this paper we suggest 
specific schemes for update and search). 

Each mobile support station is also a location server 
that maintains a list of mobile hosts within its cell. 
Whenever a mobile host joins a cell, it is included in 
the list; whenever a mobile host leaves the cell, it is 
removed from the list. Every mobile host periodically 
sends an alive signal to the mobile support station. If 
the signal of a mobile host listed in some mobile sup- 
port station does not reach the mobile support station 
for a predefined period of time, the mobile support 
station assumes that the mobile host is not (active) 
in the cell and removes it from the list. The location 
servers of the mobile support stations are connected 
with other location servers within the fixed network. 
The location servers are organized in a tree structure, 
where the location servers of mobile support stations 
are the leaves of the tree. Every A leaves are con- 
nected to a single parent location server. A non-leaf 
location server, $i, has A subtrees (each rooted in one 
of its children). There is a single root location server 
that does not have a parent, while every other location 
server has a single parent. 8( maintains A lists; the 
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j'th list, ftVfj, is associated with the >'tb child of 84. 
listj is the list of the mobile hosts that are in the cells 
of the leaves of the subtree rooted at this j'th child. 

We now present the outline of the update and 
search procedures that we use for the tree structure. 
These procedures are the base for the update and 
search procedures of the modified tree structure. The 
update procedure is invoked whenever a mobile sup- 
port station receives an indication that a mobile host 
has joined or left the cell for which the mobile support 
station is responsible. The indication for a join event 
of a mobile host m (that is not listed in the mobile 
support station list) is an alive signal from m that is 
directed to the mobile support station. The indication 
for a leave event of m is the absence of an alive signal 
for a long period (the length of the period is a function 
of how frequently alive signals are sent and the time 
required for an update, as discussed in the sequel). 

When a mobile host m joins a cell, say cj, possibly 
due to movement from another cell cj, m's identifier 
is added to the list of the mobile support station of 
c\. This addition is reported to the mobile support 
station's parent by sending a join message with m's 
identifier. When a non-leaf location server, s,-, receives 
a join message from its child, 8j , for a mobile host, tn, 
that does not exist in any of Vs lists, then includes 
m in listj and (when is not the root s,) sends a join 
message to ij's parent. Otherwise, when s,* finds m's 
identifier in one of its lists, say its**, s; (1) deletes the 
identifier of m from list* , (2) sends a delete message 
to its Jb'th child and, (3) adds the identifier of m to 
listj . Note that in this case no join message is sent. 
A search inquiry for the location of a mobile host m 
starts with a message sent by an initiator (fixed or 
mobile) host to the root of the location server tree. 
When such an inquiry message arrives at a location 
server s, s searches for m in its lists. If s is not a 
leaf and m is found in listj then s sends the inquiry 
message to its j'th child. This procedure repeats itself 
until the inquiry message reaches a mobile support 
station. The mobile support station verifies that m 
is in its cell. Upon successful verification, the address 
of the mobile support station is sent to the host that 
initiated the inquiry. 

3 The Modified TVee 

In the next two subsections we present the modifi- 
cation we propose for the upper and lower levels. Then 
we present the update and search procedures for a tree 
with modified upper and lower levels. For simplicity 
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we assume that every location inquiry arrives at the 
root of the location server tree 1 . 

3.1 Modifying the Upper Levels 
In this subsection we present an alternative structure 
for the upper levels of the tree, i.e., the levels that are 
closer to the root. The new structure of the upper 
levels improves the performance of the tree structure 
by spreading the load of queries. To measure this im- 
provement, we suggest the following analysis. Let /„ 
be the average load (queries per time unit) of outside 
queries that reach the root of the tree. Let A be the 
out-degree of a node in the tree. First we assume that 
the out-degree of every non-leaf node in the tree is A; 
later we relax this assumption. We assume that the 
load of the queries that reaches every node is evenly 
divided between its children. Thus, the average load 
for a node in level 1 is l 0 /A. Similarly the average 
load per node in level t is / 0 /A*. Let h be the level 
of the leaves of a tree T. We present a modified tree 
structure for T in which the maximal average load per 
node is / 0 /A*, for every 1 < t < h. The modification 
requires 1A 1 — (A 1 — 1)/(A— 1) additional nodes, which 
is proven necessary. 

Interestingly the modified upper levels for a tree 
with A = 2 is the well-known butterfly network. For 
out-degree A > 2 the modified upper levels form a k- 
ary butterfly (cf. [7]). The Jb-ary butterfly is a composi- 
tion of trees with out-degree A = k. The definition of 
the modified tree is naturally expanded for trees with 
uniform out-degree at each level and different degrees 
in different levels. We generalize the ib-ary butterfly 
to a set- ary butterfly. This generalization may reflect 
better the current structure of the location server tree 
which might have different out-degrees in different lev- 
els of the tree. The number of upper levels of the tree 
to be modified is a function of the desired distribution 
of the inquiry load. If the system designer must guar- 
antee that any location server has average load of no 
more than the average load of a node in level i + 1 
then t levels of the tree have to be modified. 

The h upper levels of a tree form a tree Th with h 
levels. To modify 7\ we use the following construction. 
Let Ti be a subtree of Th with depth i such that the 
leaves of Ti are leaves of Th . The modification starts 
with trees of depth one i.e., h = 1. T\ is modified to 
MT\. Ti contains a single root and Ai leaves which 
are connected to this root. The construction replaces 

'In reality a location inquiry for mobile host m might be 
addressed to a root of a subtree (say the one that Is responsible 
for New York City) in case the initiator is sure of the area m is 
in. The approach we suggest can be applied to subtrees as well. 



the root with Ai "root" nodes and connects each such 
node with all of the leaves, i.e., each such node has Ai 
outgoing links. The construction of M7}+i is defined 
recursively by MTi and the out degree A,*+i of a root 
of a subtree 7}+i- Let n,- be the number of roots in a 
MTj. The root of Tf+i is replaced by A< + irif roots. 
Each root of Af 7}+i is connected with a single root of 
each of the A l+ i MT/s. If r,+i, fc is the k'th root of 
MTi+\ then r< + i t t is connected to the (Jb-1) mod n,+ 
1 root of each of the A (+1 A/7Vs. The modified tree 
structure supports the same search procedure as the 
original tree. To balance the load of outside inquiries 
we assume that an inquiry is sent to one of the "roots" 
of the modified tree that is chosen according to some 
portion of the identifier of the mobile host m that is 
to be located. Thus each root of the modified tree 
has to maintain the location information (in the lists) 
for only some portion of the mobile hosts. This in 
turn keeps the number of update messages small — 
only the embedded tree for the mobile host for which 
the location update message has been sent is involved 
in the update. 

The division of geographic regions into cells has 
great influence on the amount of processing needed 
for location updates. For example, it is important for 
the mobile support stations that cover Japan to have a 
common ancestor that is relatively close to the leaves 
of the tree. On the other hand, the only common loca- 
tion server for mobile support stations in Japan and, 
say, England, could be the root. With such a divi- 
sion the number of update messages arriving at the 
root is small. Therefore we also suggest that in some 
cases it is better to send a copy of the update mes- 
sages to every root (and not only to a single root). 
The benefits of having identical data in each root is 
the possibility to place each root in a different (fixed) 
location. Each root will handle inquiries from its sur- 
rounding area. For example, one replicated root may 
be located on the west coast and another on the east 
coast, while both roots maintain the location data for 
every mobile host. If the inquiry initiator is on the 
west (respectively, east) coast, it starts the inquiry 
with a message to the root on the west (respectively, 
east) coast. 

3.2 Modifying the Lower Levels 

We say that two cells c x and c*i are at distance i from 
each other when a move of a mobile host from c\ to c^ 
must physically pass through at least i cells (excluding 
ci). A broadcast from a cell Ci to every cell of distance 
less than or equal to r from c\ is called broadcast with 
diameter 2r. We assume that during the time it takes 



for a mobile host m to move from a cell c\ to a cell cj at 
distance t, several complete updates can be executed. 
The mobile host triggers location updates by sending 
an alive message to the mobile support station of its 
current cell. To avoid too frequent location updates 
and for simplicity of the updates, we assume that the 
time between every two successive alive messages of a 
mobile host is long enough to guarantee completion of 
the location update. The required broadcast diameter 
for the search procedure, denoted d, depends on the 
time needed for completion of an update, the size of 
the cell, and the velocity of the mobile host. 

To locate a mobile support station m at any given 
time, it is enough to communicate with the cell for 
which the tree location database has a record and the 
neighboring cells within distance d from this cell. This 
could be easily done when any two neighboring mobile 
support stations are connected by either a direct phys- 
ical communication link or a fast virtual communica- 
tion link. When a search for a mobile support station 
m arrives at a location server 8{ that is a leaf in the 
tree (mobile support station) and $i detects that m is 
not currently in its cell, s» broadcasts the search re- 
quest to cells within distance d. Then s* receives an 
answer (found or not-found) from its neighbors and 
accordingly sends an answering message to the initia- 
tor of the search. Note that for this scheme to work, 
Si must not delete the location information concerning 
m for long enough time. The indication of disappear- 
ance is delayed for a period of time that ensures the 
completion of the next update. 

Obviously, the additional (relatively short) links be- 
tween neighboring location servers will result in effi- 
cient local broadcasts and will support h an doffs. Note 
that the location management for a mobile host that 
moves from one cell to another takes place automati- 
cally based on the periodic alive messages sent to the 
closest mobile support station and does not require 
resources for fast response as handoff does. The mod- 
ification of the lower level may support fast response 
required for handofEs. We call the following handoff 
procedure follow me handoff. The follow me handoff 
procedure does not use forwarding pointers. If during 
a communication session every packet addressed to the 
mobile support station is locally broadcast, then even 
if the mobile host moves to a new cell, the mobile host 
receives every packet sent to it. At the same time the 
mobile host notifies its session partner of its new loca- 
tion through the new mobile support station. Conse- 
quently, the session partner starts sending its packet 
to the new mobile support station. 
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3.3 Update and Search Procedures for Modi- 
fied Tree 

The correct operation of our update and search proce- 
dures relies on the following assumptions: (Al) The 
location database is initiated with all the lists empty. 
(A2) The time required to complete an update (send 
a join message towards the direction of the root and 
then send a delete message towards the previous cell) 
is bounded by t u . (A3) The time between two succes- 
sive alive signals of a mobile host m is t Q > t u . (A4) 
If mobile host m sends an alive signal at time t while 
m is in cell c,, then at time t + t a + t u m is in a cell 
Cj (possibly c,- = c ; ) that is within distance ff from c*. 
(A5) The LocalSearch procedure (as described in the 
sequel) locally broadcasts the search inquiry to all the 
cells that are within distance d. (A6) Disappearance 
of a mobile host from a cell is indicated by the mo- 
bile support station of that cell when no alive signal 
is received for i<* > t a + t u period of time. 

A mobile host m is active if (1) m sent an alive 
signal, aj, in the last period of t a time, and (2) ei- 
ther m sent alive signal, a/_i , t a time before m sent a/ 
or at least t u time has elapsed from the time m sent 
oi. Roughly speaking, the two conditions above make 
sure that a complete update that is related to the pre- 
vious or the current location has been executed. The 
requirement for our location management scheme is 
that any search for an active mobile host m will result 
in communicating with m. The code of the update 
and search procedures of a location server s< in the 
modified tree appears in (the upper portion of) Figure 
1. The code starts with the description of the actions 
taken by a mobile support station (a leaf in the loca- 
tion server tree) upon an indication of the appearance 
or disappearance of a mobile host m. Note that a mo- 
bile support station has a single list that includes the 
current mobile hosts in the cell. Note further that the 
removal of m from list (of a leaf) is only for "garbage 
collection" reasons since a>oin message to another cell 
results in changing the path to m in the location server 
tree. In order to ensure that every search succeeds, it 
is assumed that the indication of disappearance is de- 
layed for at least the time it takes for an update on 
the new location to be triggered by an alive signal and 
then to be completed. 

The code continues with the actions taken by a non- 
leaf location server upon the receipt of join and delete 
messages. A join message for a mobile host m re- 
ceived from the j'th child causes the addition of m 
to listj. In case m appears in another list of s<, say 
listk, then m is deleted from listk and a delete mes- 
sage is sent to the ib'th child. Note that join messages 



are sent only towards the roots while delete messages 
are sent only towards the leaves. In the modified tree 
a node may have more than a single parent. Thus, 
we have to define whether the message is sent simul- 
taneously to every parent or alternatively the precise 
parent(s) to whom the message is sent. Each root, r, 
of our modified tree maintains location information on 
a subset of the mobile hosts (possibly including every 
mobile host) defined by the mobile hosts' identifier. 
Therefore, update messages concerning the location 
of a mobile host m need to be sent to the parent(s) in 
the embedded tree rooted at the appropriate root(s). 
The function parent(m) executed by location server S( 
returns the parent(s) of $, in the embedded tree that 
is related to the root(s), r, that maintains location 
information on m. 

The search procedure is activated by an outside ini- 
tiator that uses the tree structure to locate a mo- 
bile host. The initiator sends a message msg = 
(search, m, initiator) to the root that maintains infor- 
mation on m and waits for a response with the address 
of the mobile support station of the current cell of m. 
When the search message reaches a mobile support 
station, a,-, then tries to locate m by direct com- 
munication and then by local broadcast. In the code 
we use the function LocalSearch for this purpose. The 
result of the LocalSearch procedure is sent directly to 
the initiator of the search request. 

Correctness Proof Sketch: We prove that the lo- 
cation management requirements hold for each mobile 
host m. The location data for a given mobile host 
m might be maintained by more than one root (and 
hence more than a single embedded tree) when the 
designer decides to have more than a single replica. 
Although the proof is written for the case of a sin- 
gle embedded tree for each mobile host m, the proof 
holds for the case of more than a single embedded tree 
for a mobile host m, Messages sent from one location 
server to another location server s$ obey the FIFO 
order. Each message arrives at its destination within a 
bounded period of time. A location database instance 
is a vector of the lists of the location servers and the 
messages sent between any two location servers. Loca- 
tion servers execute steps. A step executed by location 
server starts with zero or one message received, then 
zero or more messages sent and ends with a state tran- 
sition for the location server. A run is a (finite or infi- 
nite) sequence of instances and steps, I\ , sj, Jj, *2, • • • 
such that: (1) The application of s, to J< results in 
J j+1 . (2) Each step a,- is executed at time For 
every two steps *{ and Sj (j > i) t > t(. (3) The 
message delay time is obeyed, i.e M a if a message is sent 
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Update Procedure 
(* Leaf *) 

Receive indication for m in cell: 
if m g list then 

send rnjy := (join, m) to parent(m) 
list list U m 

Receive indication on disappearance of m from cell: 
send rjw0:sr( rum- acti^m) to parent (m) 
list := iij< — {m} 

(* Non-leaf *) 

Receive ma0 from the j'th child, msg. type = join: 
if Vlistk msg.m $ listk then 

send msg to parent(m5y.m) 
else V/mU mj#.m € do 

listk Usth - {msg.m} 

send msg :~ (delete, m) to the fc'th child 
Jiatj := ft5*y U m«j,m 

(* Non-root *) 

Receive mag from the j'Hh child, m*ff.<ype=non-aciii;e: 
if msg.m G KjIj then 

send msg to parent (m) 
fi*i> := listj - (nwj.m} 

Receive from parent, msg. type = delete: 
VHstk, msg.m € /wt* do 

send msg to the fc'th child 
listk := — {may.m} 

Search Procedure 

Receive may from parent, msg.iype = search: 
if leaf then 
LocalSearch(m) 

if found then send nwfl;=r(odrfre**) to m*£. initiator 
else send msg:=(not-found) to msg. initiator 
else 

if 3Jfc, msg.m € /wt* then 

send ros^ to the fc'th child 
else send map;=(no£-/ounc/) to rrwy. initiator 

Self-Stabilization 
Periodically: 

Vifc, Vm G Iwijk if 3i / *» m € then remove(m, liaU) 
Vfc send msg := (refresh, list*) to the Jb'tn child 

(* Remove Static Dangling Identifiers *) 
Receive msg from patent, msg.type=refreshi 
VJt, Vm € tat* if m 0 m*g,Jtj< and 
no pending msg = (join, m) to parent then 
listk := /«t* — {m} 
send msg:=(delete,m) to the k'th child 

Figure 1: Update and Search Procedures 



in 8i and received in 8$ then t$ — is a (positive) time 
period that is no longer than the message delay time. 

We prove that every instance, I, of the the loca- 
tion database contains a single location-path for each 
active mobile host m. A location-path of m in 7 is 
a list of location servers S — 8 ri 8\,-—$j that starts 
with the (appropriate) root location server s r of the 
(appropriate) tree and for which follows in S 
iilistjt of Si includes m and is the fc'th child of 
in the location server tree. We say that listk is on the 
location-path of m. For a given instance 7, an identi- 
fier m that is not in a list on the location-path of m 
is called dangling. 

Theorem 3.1 Our update and search procedures for 
a mobile host m fulfill the requirements for location 
management 

Sketch of proof: By assumption (A3) every up- 
date is completed before the next update starts. Thus, 
by induction on the number of updates (using as- 
sumption (Al) as induction base) whenever an update 
starts there are no dangling identifiers for m. Thus, 
when an update starts for a mobile host m the join 
message reaches a location server along the location- 
path S = 8r 9 s\ t " m t*i**j*'"*k of m. Then the suf- 
fix sj , • • - , sjt is replaced by the suffix leading to the 
mobile support station that received the current alive 
signal. Then a delete message eliminates the dangling 
identifiers of m in the suffix s,, • • By assump- 
tions (A2) and (A3) this delete terminates before a 
new alive signal is sent. Assumptions (A4) and (A5) 
guarantee that an active mobile host is found. As- 
sumption (A6) ensures that the location-path of an 
active mobile host is not eliminated. ■ 

4 Self-Stabilizing Location Manage- 
ment 

The update and search procedures presented in Fig- 
ure 1 do not guarantee stabilization. One reason is 
that every update is triggered by an indication at the 
mobile support station. In case a transient fault oc- 
curs, say, causing omission of an identifier of a mobile 
host m from the location information at a non-leaf lo- 
cation server, no join message will be sent. Thus, if m 
does not move to a new cell and an update takes place, 
rn is not reachable by a search that starts in the root. 
We continue by defining the self-stabilizing location 
management requirement. Starting with any (cor- 
rupted or non- corrupted) location database instance /, 
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a self-stabilizing location management scheme ensures 
that from some time forward every location database 
instance satisfies the following: for every active mobile 
host, m, there is a location-path from the (appropri- 
ate) root to a mobile support station that is within 
distance t from m's current location. To overcome 
transient faults each location server s checks periodi- 
cally that a mobile host identifier does not appear in 
more than one list of a. This ensures the existence of 
at most one location-path for every mobile host. An 
identifier m is a static dangling identifier, at a loca- 
tion server s in an instance J, if (1) m is a dangling 
identifier at 8 in 7, (2) there is no delete message for 
m pending in the link from s's parent to s in A and 
(3) there is no join message for m pending in the link 
from s to s's parent. 

The existence of static dangling identifiers might re- 
sult in an unsuccessful update — every join message 
reaches a static dangling identifier (or a descendant of 
a static dangling identifier) instead of reaching the lo- 
cation path. Our extension for the update procedure 
eliminates static dangling identifiers. Each non-leaf 
location server, s; f sends the list of mobile host iden- 
tifiers, Ustj t to its j'th child, s^s j'th child uses the 
list received from Si to eliminate every static dangling 
identifier. For this procedure we need the following 
assumption: (A7) A location server that sends a join 
message to its parent is able to detect whether the 
join message has been received (an acknowledgment 
mechanism may be used). Thus, during a join update 
a location server s is able to discard refresh messages 
that arrive after m has been included in s's lists and 
before m is included in *'s parent's list. Towards the 
end of Figure 1 we present the portion of the code that 
is executed periodically to ensure stability. 

Correctness Proof Sketch: We now state the main 
claims for the proof that the location management 
with the extended update procedure is self-stabilizing. 
For this proof we have to show that eventually a lo- 
cation database instance is reached such that there 
are no dangling identifiers. This ensures the correct 
update as proved in the previous section. In the full 
paper we show that from any instance of the location 
database that follows a finite time t\ it holds that 
for each location server no mobile host identifier 
m appears in more than one of s;'s lists. Then we 
show that from any instance of the location database 
that follows a finite time t a it holds that no static 
dangling identifier exists. These facts imply that the 
location management scheme presented in Figure 1 is 
self-stabilizing. 



5 Concluding Remarks 

In this paper we have suggested a new structure 
for location management in mobile networks. The 
structure is based on the tree location database struc- 
ture. We suggested replacing the root and some of 
the higher levels of the tree with another structure 
that balances the average load of search requests. For 
this modification we use a seUary butterfly network 
which is a generalization of the well-known k-ary but- 
terfly. We also suggested modifying the lowest level 
of the tree to reflect better the neighboring relation 
between geographic cells and to support simple loca- 
tion data management. The modification of the lower 
lever supports a simple fo!low*me handoff. 

Beyond the self-stabilization property of the loca- 
tion database, our modification of the tree structure is 
a more robust than the original tree structure — if the 
location information of any mobile host is maintained 
by two embedded trees then even if one of the roots 
is crashed still the location of this mobile host can be 
found. 
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